Public-key infrastructure (PKI) enables secure transfer of information between entities without using usernames, passwords, or shared secrets. However, a PKI deployment requires certificate authorities (CAs) and validation authorities (VAs), which are single points of failure. Therefore, if a CA or VA becomes disabled or compromised, every entity that relies on the CA or the VA may no longer be able to communicate securely with other entities. Further, these entities may become more vulnerable to attacks, such as spoofing, after the CA or VA is compromised or disabled.
Moreover, in a conventional PKI deployment, managing digital certificates becomes increasingly complex process as the number of entities in deployment escalates. For deployments that include tens or even hundreds of millions of entities (e.g., internet of things), the management of digital certificates may be prohibitively complex.